Översikt över personuppgiftsbehandling

Purpose and status

This page is an operational overview, not an executed data processing addendum (DPA). A signed customer DPA, where appropriate, must identify the parties, roles, subject matter, duration, instructions and applicable law without relying on this overview alone.

Likely roles

Celiums Solutions, LLC is the sole operator of OncoRadar. For ordinary account administration and service security, it may act as an independent controller or business. When a customer organization submits personal data for processing under documented instructions, the final DPA may characterize Celiums Solutions, LLC as processor or service provider for that data. Role allocation depends on actual use and law.

Processing scope

The service processes account identity, memberships, conversations, uploaded documents and images, de-identified derivatives, findings, developer metadata, security records and privacy requests to provide, secure and support OncoRadar. Uploads are accepted only through the upload flow, are encrypted with a customer-managed key, and are de-identified before any model or reviewer sees content; originals are retained 30 days by default. Material intended for individual patient care is out of scope.

A Business Associate Agreement between the operator and its cloud provider is being put in place and would be referenced as an annex to a customer DPA where applicable. No business associate relationship between a customer and the operator arises from these materials alone; a customer that requires one must contact the legal address before processing that depends on it.

Core DPA topics

A final DPA should address documented instructions, confidentiality, security measures, subprocessor notice, assistance with rights and incidents, deletion or return, audits, international transfers, government requests, liability alignment and an annex describing data subjects, categories and duration.

• Processors: the entities named in the Subprocessor Notice — a cloud infrastructure provider (hosting, storage, encryption, OCR, identifier detection, clinical entity coding, medical imaging storage and the research language model, US East region) and a calibrated decision model provider that receives only de-identified text or literature; contract details remain pending confirmation.
• Annexes: the cloud provider Business Associate Agreement (in progress), the de-identification description in the Privacy Policy, and the Dataset Contribution Terms for any per-item dataset consent.
• Deletion: active-record, upload purge and organization-workspace handling require an operational review; no request is complete merely because it was submitted, and backups are not erased instantly.

Security and audits

Current measures are summarized in the Security Notice and reusable security inventory, including the customer-managed key and role separation for uploads. No certification, audit report, penetration-test cadence, transfer mechanism or customer audit procedure is promised unless expressly agreed after verification.

Open items

Formation state, addresses, governing law, transfer mechanisms, numeric retention periods beyond the 30-day original default, incident notice timing, audit mechanics, signature authority, the executed Business Associate Agreement and jurisdiction-specific annexes remain pending. Contact the legal address to discuss a reviewed DPA before production processing that requires one.